Patchfirst
Patchfirst
T1059.004Execution

Unix Shell

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges. Unix shells also…

attack.mitre.org ↗
CVEs17
In 17
Reports1

Detections

19 Sigma rules tagged T1059.004
Unix ShellT1059.00419 general rules
All 19 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Unix Shell

17 CVEs, by priority. Each link shows its badge.
  1. CVE-2023-46604Apache ActiveMQ Deserialization of Untrusted Data Vulnerability
    Apache · ActiveMQKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell+1 more
    MITRE CTID mapping of the KEV entry · primary impact
    >99.9%Top 0.01%
    79.9priority
  2. CVE-2024-51378CyberPanel Incorrect Default Permissions Vulnerability
    CyberPersons · CyberPanelKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell
    AI mapping from the description · primary impact
    94.7%Top 0.14%
    79.8priority
  3. CVE-2024-24919Check Point Quantum Security Gateways Information Disclosure Vulnerability
    Check Point · Quantum Security GatewaysKEVRansomwarePublic exploitHigh · 8.6T1059.004Unix ShellT1202Indirect Command Execution+3 more
    MITRE CTID mapping of the KEV entry · follow-on activity
    >99.9%Top 0.02%
    79.0priority
  4. CVE-2014-6271GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
    GNU · Bourne-Again Shell (Bash)KEVPublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+1 more · 2 reports
    MITRE CTID mapping of the KEV entry · primary impact
    >99.9%Top 0.01%
    76.0priority
  5. CVE-2026-48907Widget Factory Joomla Content Editor Improper Access Control Vulnerability
    Widget Factory · Joomla Content Editor KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell
    AI mapping from the description · primary impact
    85.4%Top 0.28%
    74.8priority
  6. CVE-2014-6278GNU Bash OS Command Injection Vulnerability
    GNU · GNU BashKEVPublic exploitHigh · 8.8T1059.004Unix Shell1 report
    AI mapping from the description · primary impact
    99.7%Top 0.05%
    73.0priority
  7. CVE-2022-33891Apache Spark Command Injection Vulnerability
    Apache · SparkKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell1 report
    AI mapping from the description · primary impact
    93.2%Top 0.17%
    73.0priority
  8. CVE-2014-7169GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
    GNU · Bourne-Again Shell (Bash)KEVPublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+1 more
    MITRE CTID mapping of the KEV entry · primary impact
    99.9%Top 0.03%
    69.9priority
  9. CVE-2016-10033PHPMailer Command Injection Vulnerability
    PHP · PHPMailerKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell
    MITRE CTID mapping of the KEV entry · primary impact
    99.7%Top 0.05%
    69.9priority
  10. CVE-2022-44877CWP Control Web Panel OS Command Injection Vulnerability
    CWP · Control Web PanelKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell
    AI mapping from the description · primary impact
    >99.9%Top 0.01%
    69.9priority
  11. CVE-2025-25257Fortinet FortiWeb SQL Injection Vulnerability
    Fortinet · FortiWebKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell+3 more
    MITRE CTID mapping of the KEV entry · primary impact
    99.9%Top 0.03%
    69.9priority
  12. CVE-2021-36380Sunhillo SureLine OS Command Injection Vulnerablity
    Sunhillo · SureLineKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell
    MITRE CTID mapping of the KEV entry · primary impact
    97.8%Top 0.09%
    69.8priority
  13. CVE-2022-20699Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
    Cisco · Small Business RV160, RV260, RV340, and RV345 Series RoutersKEVPublic exploitCritical · 9.8T1133External Remote ServicesT1059.004Unix Shell
    MITRE CTID mapping of the KEV entry · primary impact
    72.5%Top 0.56%
    69.7priority
  14. CVE-2023-39780ASUS RT-AX55 Routers OS Command Injection Vulnerability
    ASUS · RT-AX55 RoutersKEVPublic exploitHigh · 8.8T1588Obtain CapabilitiesT1078Valid Accounts+3 more
    MITRE CTID mapping of the KEV entry · primary impact
    39.5%Top 1.4%
    68.9priority
  15. CVE-2024-27443Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
    Synacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitMedium · 6.1T1566.002Spearphishing LinkT1059.004Unix Shell+2 more
    MITRE CTID mapping of the KEV entry · primary impact
    24.6%Top 2.1%
    66.8priority
  16. CVE-2022-20700Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability
    Cisco · Small Business RV160, RV260, RV340, and RV345 Series RoutersKEVCritical · 9.8T1190Exploit Public-Facing ApplicationT1059.004Unix Shell
    MITRE CTID mapping of the KEV entry · primary impact
    5.7%Top 7%
    63.5priority
  17. CVE-2023-44221SonicWall SMA100 Appliances OS Command Injection Vulnerability
    SonicWall · SMA100 AppliancesKEVHigh · 7.2T1059.004Unix ShellT1543Create or Modify System Process+2 more
    MITRE CTID mapping of the KEV entry · primary impact
    76.3%Top 0.46%
    62.9priority

Passages that support these links

↑ ↓ chooseEnter openEsc close